For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

delvinadm_21686's avatar
delvinadm_21686
Icon for Nimbostratus rankNimbostratus
Feb 18, 2009

URL Rewrite without Redirect

Hi everybody,

 

 

I've got a big problem, which I can't resolv.

 

 

The client types in the adressbar:

 

www.somesiteA.com/AAA

 

 

and the Loadbalancer should rewrite to this:

 

www.somesiteB.com:4444/AAA

 

 

But the important thing is, a HTTP::rewrite is not possible.

 

 

The client should see www.somesiteA.com/AAA, the Loadbalancer should act as an reverse Proxy.

 

 

I want the same result, as I would use the ProxyPass module on an apache httpd.

 

 

It would be very nice, to get a solution for this!

 

 

Thank you very much so far.

22 Replies

  • Hi Aaron,

     

     

    thank you very much for your iRule update. I updated the iRule and the logentires are:

     

     

    Feb 20 16:21:18 tmm tmm[933]: Rule webservicetest7 : 145.xxx.xxx.46:29830: New request to webservice.xxx.xx/WebService

     

    Feb 20 16:21:18 tmm tmm[933]: Rule webservicetest7 : 145.xxx.xxx.46:29831: New request to webservice.xxx.xx/favicon.ico

     

    Feb 20 16:21:21 tmm tmm[933]: Rule webservicetest7 : 145.xxx.xxx.46:29850: New request to webservice.xxx.xx/favicon.ico

     

     

    So exactly the same result, we know from httpfox or curl. After the http /get, everything stops...

     

     

    Do you have any idea? Maybe some module or service is missing?

     

     

     

    Posted By hoolio on 02/20/2009 4:04 AM

     

    I updated the examples in this post (Click here) to fix a typo and add some debug logging. Can you update the rule you're testing and see if you see any log output in /var/log/ltm?

     

    Also, if you're adding a rule via the GUI, you need to remove the rule definition lines as the GUI adds this for you. So remove the first line:

     

    rule loadBalancingiRule {

     

    And the last matching curly brace } at the end.

     

    Aaron

     

     

  •  

    ...how you do the URI switch...

     

     

     

     

    In your original post, I must have missed that you wanted to switch URIs too.

     

     

    We do not customarily perform URI rewrites, but instead redirect in those cases. I have provided what we do below.

     

     

    However, I know what you are talking about - So I give another example to show how you can peform a URI rewrite as is done in ProxyPass (untested) or even Apache mod_rewrite.

     

    The Scenario would be something like:

     

    1) web user access http://somesite.com/myapp/index.jsp

     

    2) request is actually served as http://somesite.com/yourapp/index.jsp

     

    3) web user does not know the URI is changing behind the BigIP

     

     

    If you are interfacing with the BigIP Web GUI, then you will want to copy and paste this exact code into your iRule. Choose either website_redirect or website_rewrite - whichever fits your needs.

     

     

    copy this into a iRule named something like "website__redirect"

     

     
     when HTTP_REQUEST priority 100 { 
         set http_host [string tolower [string trim [getfield [HTTP::host] ":" 1]]] 
          general URI redirecting 
         switch $http_host { 
             "info.webservice.xxx.xx" { 
                 HTTP::redirect webservice.xxx.xx/info 
                 return 
             } 
             "support.webservice.xxx.xx" { 
                 HTTP::redirect webservice.xxx.xx/support 
                 return 
             } 
         } 
     } 
     

     

     

     

    copy this into a iRule named something like "website__rewrite"

     

     
     when HTTP_REQUEST priority 100 { 
         set http_host [string tolower [string trim [getfield [HTTP::host] ":" 1]]] 
          general URI rewriting 
         switch $http_host { 
             "info.webservice.xxx.xx" { 
                 HTTP::host webservice.xxx.xx 
                 HTTP::uri /info 
                 return 
             } 
             "support.webservice.xxx.xx" { 
                 HTTP::host webservice.xxx.xx 
                 HTTP::uri /support 
                 return 
             } 
             "webservice.xxx.xx" { 
                 switch [HTTP::uri] { 
                     "/liveProduct/plasticbags" { 
                     HTTP::uri "/productapp/query.jsp?p=34562" 
                     } 
                     "/liveProduct/paperbags" { 
                         HTTP::uri "/productapp/query.jsp?p=56245" 
                     } 
                 } 
             } 
         } 
     } 
     

     

     

     

    copy this into a iRule named something like "website__loadbalancing"

     

     
     when HTTP_REQUEST priority 200 { 
         set http_host [string tolower [string trim [getfield [HTTP::host] ":" 1]]] 
          
          test that the server pool has active server members 
          
         if { [catch {set test [active_members ihstestweb]} result] }{ 
             log local0.warn "pool ihstestweb has no active members, Request: [HTTP::host][HTTP::uri], Result: $result" 
         } 
          
          set the server pool 
          
         if { $http_host equals "webservice.xxx.xx" } { 
             pool ihstestweb 
             return 
         } else { 
             HTTP::respond 404 content { Not Found } noserver  
         } 
     } 
     

     

     

    Is this more like what you are looking for?

     

     

    We set up our 640 applications to respond on a unique port number, to serve any request regardless of the value of the HTTP 1.1 "Host" header.

     

     

    So this means we have to be careful how we add nodes into pools.

     

     

    So my policy is to assign each project a set of domains (official and redirect domains) and a unique port number.

     

     

    In the BigIP, I make sure the pool has some kind of indication of the official domain in the name somehow, and when I audit the pools, I make sure the pool for the official domain has the correct unique port numbers.

     

     

    Since the project has one unique port number, no matter which physical server (node) the application is served from, the port number is always the same.

     

     

    So in your case, you may name the pool of nodes something like this, with the following example nodes.

     

     

    Your audit policy:

     

     
     1) Project WebsiteAAA 
     Official domain: www.websiteaaa.com 
     redirect domain: websiteaaa.com 
     redirect domain: www.websiteaaa.net 
     redirect domain: websiteaaa.net 
     assigned unique port number: 98345 
     BigIP Pool: vhost_websiteaaa_pool 
     Is a SSL Site: NO 
     

     

     

    Your BigIP Pool Configuration:

     

     
     Pool: vhost_websiteaaa_pool 
     Node: server001.company.com:98345 
     Node: server023.company.com:98345 
     Node: server009.company.com:98345 
     Node: server016.company.com:98345 
     

     

     

    So then if a user types this URL into their browser URL bar:

     

    http://www.websiteaaa.com/about/company.jsp

     

     

    The request is "proxied" through the BigIP, and may actually be served by this actual "HTTP request path":

     

    http://server009.company.com:98345/about/company.jsp

     

     

    But when the web user's request is actually completed, and they receive their result, their web browser URL bar will now read:

     

    http://www.websiteaaa.com/about/company.jsp

     

     

    Which actually is the same URL they started with.

     

     

     

    Or to follow the above iRule as I wrote it above, the user's URL may start out to be:

     

    http://websiteaaa.com/liveProduct/plasticbag

     

     

    And they will end with that same URL in their browser bar after the request is completed and the web page is rendered.

     

     

     

    Good Luck!

     

     

    -RG